Bugzilla – Bug 59087
VUL-0: CVE-2004-0797: zlib: DoS in zlib 1.2
Last modified: 2021-09-26 10:35:44 UTC
Date: Mon, 23 Aug 2004 07:31:24 +0200 From: Martin Schulze <joey@infodrom.org> To: vendor-sec@lst.de Subject: [vendor-sec] CAN-2004-0797: Denial of service in zlib 1.2 Parts/Attachments: 1 Shown 14 lines Text 2 OK 152 lines Text ---------------------------------------- Hi, our zlib1.2 maintainer sent the following message upstream. This issue is already public due to http://bugs.debian.org/252253. This only affects zlib 1.2 - inflate() was rewritten between 1.1 and 1.2). Regards, Joey
<!-- SBZ_reproduce --> Which products ship zlib 1.2?
9.1 / SLES 9. 9.0 and below use 1.1.4 and less
Created attachment 22841 [details] Attachment which was added to the mail ...
patch extracted ... package building who will write patchinfo files (SLES9/9.1) ?
Hold, I will write them.
Created attachment 22871 [details] box patchinfo for zlib and zlib-devel ...
Created attachment 22872 [details] patchinfo for maintained, zlib and zlib-devel ...
Date: Wed, 25 Aug 2004 01:23:42 +0400 From: Dmitry V. Levin <ldv@altlinux.org> To: vendor-sec@lst.de Cc: Mark Brown <broonie@sirena.org.uk> Subject: Re: [vendor-sec] CAN-2004-0797: Denial of service in zlib 1.2 Parts/Attachments: 1.1 Shown ~28 lines Text 1.2 OK ~27 lines Text 2 196 bytes Application ---------------------------------------- Hi, On Mon, Aug 23, 2004 at 07:31:24AM +0200, Martin Schulze wrote: [...] > The source of the problem appears to be that throughout the inflate() > function the standard way to handle a detected error is: > > strm->msg = (char *)"Error message"; > strm->mode = BSD; > break; > > However, while processing the CODELENS state there are a couple of cases > where an error can be detected inside a while loop so this idiom doesn't > exit the main processing but instead only exits the while loop. This > causes the code to continue into inflate_trees() and potentially crash > on uninitialised values in the lens array[1]. The fix below replaces > the break statement with a goto statement that does the right thing. The fix proposed by Mark Brown does not set proper return value of inflate() and inflateBack() functions in case of error inside loop. Either ret variable should be set to Z_DATA_ERROR right before goto statement, or state->mode should be tested right after loop. Here is a patch which demonstrates second approach.
Created attachment 22894 [details] alternative patch Please see last comment.
packages submitted to 9.1/SLES9 and stable
CAN-2004-0797
packages approved.. .adv. will be released in a few minutes
CVE-2004-0797: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)